CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.
Explanation of Vulnerability in Simple Terms
Envo's Templates & Widgets for Elementor and WooCommerce versions up to 1.4.4 contain an access control flaw that allows authenticated users to modify content they should not have permission to change. The vulnerability requires a logged-in account but no special privileges. Site administrators should update to a version newer than 1.4.4 to prevent unauthorized content modification.
What an attacker can do
Modify content or settings they lack permission to change.
Potential impact on your site
Authenticated users can alter site content, widgets, or WooCommerce settings without proper authorization.
Conditions required to exploit
Attacker must have a valid user account on the site (low privilege level).
Key dates
External resources
Related vulnerabilities
